Skip to content

fix(docker): build the image from an allowlisted context in a builder stage - #2034

Open
Yury Semikhatsky (yury-s) wants to merge 1 commit into
microsoft:mainfrom
yury-s:fix-docker-source-layer
Open

Yury Semikhatsky (yury-s) wants to merge 1 commit into
microsoft:mainfrom
yury-s:fix-docker-source-layer

Conversation

@yury-s

@yury-s Yury Semikhatsky (yury-s) commented Nov 3, 2026 •

Copy link
Copy Markdown
Member

Summary

  • .dockerignore is an allowlist of the build inputs, so VCS metadata, registry credentials and local environment files stay out of the build context.
  • The client builds in a separate builder stage from a bind mount; the final image gets only the playwright-java artifacts in /root/.m2 plus the browsers and the driver.
  • Install libatomic1, which the Node.js Linux binaries link against since 25.

… stage

- Send only the build inputs to the Docker build context: .dockerignore is
  an allowlist, which keeps VCS metadata and CI-written files out of it.
- Bind-mount the build context into a separate builder stage instead of
  COPYing it. The final stage gets only the playwright-java artifacts of
  the local Maven repository and runs the CLI from a bind mount of the
  builder's classes and runtime dependencies.
- Install libatomic1, which the Node.js binaries link against since 25.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant